PMG ClamAV updates fail

[Xela]

Hi there,

I am getting fails while updating ClamAV:

ClamAV update process started at Sun Jan 29 20:46:38 2023
WARNING: Can't query current.cvd.clamav.net
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Trying to retrieve CVD header from https://database.clamav.net/daily.cvd
WARNING: remote_cvdhead: Download failed (6) WARNING:  Message: Couldn't resolve host name
WARNING: Failed to get daily database version information from server: https://database.clamav.net
ERROR: check_for_new_database_version: Failed to find daily database using server https://database.clamav.net.

Ping is ok:

# ping database.clamav.net
PING database.clamav.net(2606:4700::6810:da54 (2606:4700::6810:da54)) 56 data bytes
64 bytes from 2606:4700::6810:da54 (2606:4700::6810:da54): icmp_seq=1 ttl=58 time=2.37 ms
64 bytes from 2606:4700::6810:da54 (2606:4700::6810:da54): icmp_seq=2 ttl=58 time=2.37 ms
--- database.clamav.net ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 2.372/2.372/2.373/0.000 ms

Using latest Kernel and PMG 7.2-3:

Linux mx1 6.1.2-1-pve #1 SMP PREEMPT_DYNAMIC PVE 6.1.2-1 (2023-01-10T00:00Z) x86_64 GNU/Linux

Is this known? Do you know how this is solved?

 

[Stoiko Ivanov]

Hmm - check the journal since boot (`journalctl -b`) - maybe it contains some hints where the issue is coming from.

 

[Xela]

Dear Stoiko,

thank you for your support. There are no hints with 'journalctl -b ', everything is fine. I installed apparmor-utils and changed complain-mode (aa-complain /usr/sbin/clamd). --- (https://forum.proxmox.com/threads/clamav-freshclam-update-errors.103848/#post-458710)

I am still getting:

ClamAV update process started at Mon Jan 30 19:37:54 2023
WARNING: Can't query current.cvd.clamav.net
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Trying to retrieve CVD header from https://database.clamav.net/daily.cvd
WARNING: remote_cvdhead: Download failed (6) WARNING:  Message: Couldn't resolve host name
WARNING: Failed to get daily database version information from server: https://database.clamav.net
ERROR: check_for_new_database_version: Failed to find daily database using server https://database.clamav.net.
Trying again in 5 secs...

Best regards

 

[Stoiko Ivanov]

Try uninstalling apparmor and rebooting

if this does not help - please share the journal

 

[Xela]

I removed apparmor with 'apt-get remove apparmor' (is purging a better way ?) and clamav updates are working now, also chrony is working now and ntp is also installable after removing apparmor. Isn't that a security issue when apparmor is removed?

 

[Stoiko Ivanov]

Isn't that a security issue when apparmor is removed?

It depends on your particular needs - but for most installations it's acceptable to keep it removed (our installer does not ship it for example)
The issue is that the clamav apparmor profiles seem incompatible with newer kernels like the pve-kernel (although I'm not sure they work with the current stock debian kernel either (haven't tried))
If you want to keep apparmor - you probably need to adapt the profile for clamav and freshclam

I hope this helps!

 

[kentur]

What's missed here is
aa-complain /usr/bin/freshclam

freshclam handles updates, not clamd.